                             :catalog_item_identity {:name "coll2 guest read"
                                                     :collection_applicable true
                                                     :collection_identifier {:temporal {:start_date "2003-01-01T00:00:00Z"
-                                                                                       :end_date "2006-01-01T00:00:00Z"
+                                                                                       :stop_date "2006-01-01T00:00:00Z"
                                                                                        :mask "disjoint"}}
                                                     :provider_id "PROV1"}})
         (is (= {coll1 ["read"]

                            :catalog_item_identity {:name "coll2 guest read"
                                                    :collection_applicable true
                                                    :collection_identifier {:temporal {:start_date "2003-01-01T00:00:00Z"
                                                                                       :end_date "2006-01-01T00:00:00Z"
                                                                                       :mask "contains"}}
                                                    :provider_id "PROV1"}})
        (is (= {coll1 []

               (get-coll-permissions)))))))

;; For CMR-3210:

(deftest granule-permissions-test
  (let [token (e/login (u/conn-context) "user1" ["group-create-group"])
        group (u/make-group {:name "groupwithuser1" :members ["user1"]})
        created-group-concept-id (:concept_id (u/create-group token group))
        ;; required for ACLs that will reference this group
        _ (u/wait-until-indexed)
        save-prov1-collection #(u/save-collection {:provider-id "PROV1"
                                                      :entry-title (str % " entry title")
                                                      :native-id %
                                                      :short-name %})
        coll1 (save-prov1-collection "coll1")
        gran1 (save-granule coll1)
        create-acl #(:concept_id (ac/create-acl (u/conn-context) % {:token token}))
        update-acl #(ac/update-acl (u/conn-context) %1 %2 {:token token})]

    (testing "no permissions granted"
      (are [user permissions]
        (= {gran1 permissions}
           (get-permissions user gran1))
        :guest []
        :registered []
        "user1" []))

    (testing "permissions granted to guests"
      (let [acl (create-acl
                  {:group_permissions [{:permissions [:read]
                                        :user_type :guest}]
                   :catalog_item_identity {:name "prov1 granule read"
                                           :granule_applicable true
                                           :provider_id "PROV1"}})]
        (are [user permissions]
          (= {gran1 permissions}
             (get-permissions user gran1))
          :guest ["read"]
          :registered []
          "user1" [])

        (testing "permissions granted to registered users"
          (update-acl acl {:group_permissions [{:permissions [:read :order]
                                                :user_type :registered}]
                           :catalog_item_identity {:name "prov1 granule read"
                                                   :granule_applicable true
                                                   :provider_id "PROV1"}})

          (are [user permissions]
            (= {gran1 permissions}
               (get-permissions user gran1))
            :guest []
            :registered ["read" "order"]
            "user1" ["read" "order"]))

        (testing "permissions granted to a specific group"
          (update-acl acl {:group_permissions [{:permissions [:read]
                                                :group_id created-group-concept-id}]
                           :catalog_item_identity {:name "prov1 granule read"
                                                   :granule_applicable true
                                                   :provider_id "PROV1"}})

          (are [user permissions]
            (= {gran1 permissions}
               (get-permissions user gran1))
            :guest []
            :registered []
            "user1" ["read"]))))))

(deftest granule-permissions-with-collection-identifier-test
  (let [token (e/login (u/conn-context) "user1" ["group-create-group"])
        group (u/make-group {:name "groupwithuser1" :members ["user1"]})
        created-group-concept-id (:concept_id (u/create-group token group))
        ;; required for ACLs that will reference this group
        _ (u/wait-until-indexed)
        save-prov1-collection #(u/save-collection {:provider-id "PROV1"
                                                     :entry-title (str % " entry title")
                                                     :native-id %
                                                     :short-name %})
        coll1 (save-prov1-collection "coll1")
        coll2 (save-prov1-collection "coll2")
        gran1 (save-granule coll1)
        gran2 (save-granule coll2)
        create-acl #(:concept_id (ac/create-acl (u/conn-context) % {:token token}))
        update-acl #(ac/update-acl (u/conn-context) %1 %2 {:token token})]

    (u/wait-until-indexed)

    (testing "no permissions granted"
      (are [user permissions]
        (= {gran1 permissions}
           (get-permissions user gran1))
        :guest []
        :registered []
        "user1" []))

    (testing "permissions granted to guests"
      (let [acl (create-acl
                  {:group_permissions [{:permissions [:read]
                                        :user_type :guest}]
                   :catalog_item_identity {:name "prov1 granule read"
                                           :granule_applicable true
                                           :collection_applicable true
                                           :collection_identifier {:entry_titles ["coll1 entry title"]}
                                           :provider_id "PROV1"}})]
        (are [user permissions]
          (= {gran1 permissions
              ;; also ensure that the other granule under coll2 doesn't get any permissions from this ACL
              gran2 []}
             (get-permissions user gran1 gran2))
          :guest ["read"]
          :registered []
          "user1" [])

        (testing "permissions granted to registered users"
          (update-acl acl {:group_permissions [{:permissions [:read :order]
                                                :user_type :registered}]
                           :catalog_item_identity {:name "prov1 granule read"
                                                   :granule_applicable true
                                                   :collection_applicable true
                                                   :collection_identifier {:entry_titles ["coll1 entry title"]}
                                                   :provider_id "PROV1"}})

          (are [user permissions]
            (= {gran1 permissions
                gran2 []}
               (get-permissions user gran1 gran2))
            :guest []
            :registered ["read" "order"]
            "user1" ["read" "order"]))

        (testing "no permissions are granted with granule_applicable = false"
          (update-acl acl {:group_permissions [{:permissions [:read :order]
                                                :user_type :registered}]
                           :catalog_item_identity {:name "prov1 granule read"
                                                   :granule_applicable false
                                                   :collection_applicable true
                                                   :collection_identifier {:entry_titles ["coll1 entry title"]}
                                                   :provider_id "PROV1"}})

          (are [user permissions]
            (= {gran1 permissions
                gran2 []}
               (get-permissions user gran1 gran2))
            :guest []
            :registered []
            "user1" []))

        (testing "permissions granted to a specific group"
          (update-acl acl {:group_permissions [{:permissions [:read]
                                                :group_id created-group-concept-id}]
                           :catalog_item_identity {:name "prov1 granule read"
                                                   :granule_applicable true
                                                   :collection_applicable true
                                                   :collection_identifier {:entry_titles ["coll1 entry title"]}
                                                   :provider_id "PROV1"}})

          (are [user permissions]
            (= {gran1 permissions
                gran2 []}
               (get-permissions user gran1 gran2))
            :guest []
            :registered []
            "user1" ["read"]))))))

(deftest granule-permissions-with-access-value-test
  (let [token (e/login (u/conn-context) "user1" ["group-create-group"])
        group (u/make-group {:name "groupwithuser1" :members ["user1"]})
        created-group-concept-id (:concept_id (u/create-group token group))
        ;; required for ACLs that will reference this group
        _ (u/wait-until-indexed)
        save-prov1-collection #(u/save-collection {:provider-id "PROV1"
                                                   :entry-title (str % " entry title")
                                                   :native-id %
                                                   :short-name %})
        coll1 (save-prov1-collection "coll1")
        ;; no access value
        gran1 (save-granule coll1)
        ;; mid access value
        gran2 (save-granule coll1 {:access-value 5})
        ;; high access value
        gran3 (save-granule coll1 {:access-value 10})
        create-acl #(:concept_id (ac/create-acl (u/conn-context) % {:token token}))
        ;; guest read coll1 granules with undefined access value
        acl1 (create-acl {:group_permissions [{:permissions [:read]
                                               :user_type :guest}]
                          :catalog_item_identity {:name "prov1 granules w/ undefined access value"
                                                  :granule_applicable true
                                                  :granule_identifier {:access_value {:include_undefined_value true}}
                                                  :provider_id "PROV1"}})
        ;; registered read granules with access value up to 7
        acl2 (create-acl {:group_permissions [{:permissions [:read]
                                               :user_type :registered}]
                          :catalog_item_identity {:name "prov1 granules w/ max access value"
                                                  :granule_applicable true
                                                  :granule_identifier {:access_value {:max_value 7}}
                                                  :provider_id "PROV1"}})
        ;; specific group read granules with access value 7 or higher
        acl3 (create-acl {:group_permissions [{:permissions [:read]
                                               :user_type :registered}]
                          :catalog_item_identity {:name "prov1 granules w/ min access value"
                                                  :granule_applicable true
                                                  :granule_identifier {:access_value {:min_value 7}}
                                                  :provider_id "PROV1"}})]
    (u/wait-until-indexed)
    (are [user result]
      (= result (get-permissions user gran1 gran2 gran3))
      :guest {gran1 ["read"]
              gran2 []
              gran3 []}
      :registered {gran1 []
                   gran2 ["read"]
                   gran3 ["read"]})))

(deftest granule-permissions-with-temporal-value-test
  (let [token (e/login (u/conn-context) "user1" ["group-create-group"])
        group (u/make-group {:name "groupwithuser1" :members ["user1"]})
        created-group-concept-id (:concept_id (u/create-group token group))
        ;; required for ACLs that will reference this group
        _ (u/wait-until-indexed)
        save-prov1-collection #(u/save-collection {:provider-id "PROV1"
                                                   :entry-title (str % " entry title")
                                                   :native-id %
                                                   :short-name %})
        coll1 (save-prov1-collection "coll1")
        ;; no temporal
        gran1 (save-granule coll1)
        ;; temporal range
        gran2 (save-granule coll1 {:temporal {:range-date-time {:beginning-date-time "2002-01-01T00:00:00Z"
                                                                :ending-date-time "2005-01-01T00:00:00Z"}}})
        ;; single date-time
        gran3 (save-granule coll1 {:temporal {:single-date-time "1999-01-01T00:00:00Z"}})

        create-acl #(:concept_id (ac/create-acl (u/conn-context) % {:token token}))

        acl1 (create-acl {:group_permissions [{:permissions [:read]
                                               :user_type :guest}]
                          :catalog_item_identity {:name "prov1 granules between 2000 and 2011"
                                                  :granule_applicable true
                                                  :granule_identifier {:temporal {:start_date "2000-01-01T00:00:00Z"
                                                                                  :stop_date "2011-01-01T00:00:00Z"
                                                                                  :mask "contains"}}
                                                  :provider_id "PROV1"}})

        acl2 (create-acl {:group_permissions [{:permissions [:read]
                                               :user_type :registered}]
                          :catalog_item_identity {:name "prov1 granules before 2000"
                                                  :granule_applicable true
                                                  :granule_identifier {:temporal {:start_date "1900-01-01T00:00:00Z"
                                                                                  :stop_date "2000-01-01T00:00:00Z"
                                                                                  :mask "contains"}}
                                                  :provider_id "PROV1"}})]
    (u/wait-until-indexed)
    (are [user result]
      (= result (get-permissions user gran1 gran2 gran3))
      :guest {gran1 []
              gran2 ["read"]
              gran3 []}
      :registered {gran1 []
                   gran2 []
                   gran3 ["read"]})))

(deftest collection-provider-level-permission-check-test
  ;; Tests ACLs which grant the provider-level update/delete permissions to collections
